App-to-App-Layer VPN Mapping
com.apple.vpn.managed.appmapping
The payload that configures per-app VPN settings.
macOS 10.9+
Apple schemaOnly one instance per profile
Configuration Keys (1)
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
AppLayerVPNMappingarrayrequired | array | The array of VPN mapping dictionaries. | Default: — | Range: — |
| dict | A dictionary defining a per-app VPN relationship. | Default: — | Range: — | |
Identifierstringrequired | string | The bundle identifier of the app using the per-app VPN. | Default: — | Range: — |
VPNUUIDstringrequired | string | The identifier of the per-app VPN payload, which defines the per-app VPN that the app uses. See the `VPNUUID` key of the `AppLayerVPN` payload. | Default: — | Range: — |
| string | The code signature designated requirement of the app using the per-app VPN. | Default: — | Range: — | |
| string | The code signature signing identifier of the app using the per-app VPN. | Default: — | Range: — | |
PathstringmacOS 10.15+ | string | The file-system path of the executable using the per-app VPN. | Default: — | Range: — |
MatchToolsarraymacOS 10.15.4+ | array | An array of dictionaries. Each dictionary specifies a per-app VPN rule. Use this property to restrict this per-app VPN rule to only match the app's spawned _helper tool_ network traffic. For example, to match network traffic that the `curl` command generates when run from the Terminal.app, create an app mapping payload for Terminal.app and set the payload's `MatchTools` key to an array that contains a dictionary that matches the `curl` command-line tool. If you don't specify the `MatchTools` key, this per-app VPN rule matches all network traffic that the matching app and its spawned helper tools generate. | Default: — | Range: — |
MatchToolsItemdict | dict | Specifies a per-app VPN rule to match network traffic that the app's spawned command-line tool generates. | Default: — | Range: — |
| string | The code signature designated requirement of the command-line tool using the per-app VPN. | Default: — | Range: — | |
| string | The code signature signing identifier of the command-line tool using the per-app VPN. | Default: — | Range: — | |
PathstringmacOS 10.15.4+ | string | The file-system path of the command-line tool using the per-app VPN. | Default: — | Range: — |